fix(deps): upgrade dependencies to address security vulnerabilities (#276)

* update package versions

* bump pyJWT

* fix pr comments

---------

Co-authored-by: Dominik Bezic <dominikbezic@microsoft.com>

Author: dbezic

libraries/microsoft-agents-a365-notifications/pyproject.toml

@@ -30,6 +30,8 @@ dependencies = [
     "microsoft-agents-activity",
     "microsoft-agents-hosting-core",
     "pydantic",
+    # Publish the security floor for the hosting SDK's transitive dependency.
+    "PyJWT",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-observability-extensions-langchain/pyproject.toml

@@ -31,6 +31,9 @@ dependencies = [
     "opentelemetry-sdk",
     "opentelemetry-instrumentation",
     "wrapt",
+    # Publish security floors for LangChain's transitive dependencies.
+    "langsmith",
+    "anyio",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-observability-extensions-openai/pyproject.toml

@@ -30,6 +30,10 @@ dependencies = [
     "opentelemetry-api",
     "opentelemetry-sdk",
     "opentelemetry-instrumentation",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-observability-extensions-semantickernel/pyproject.toml

@@ -30,6 +30,10 @@ dependencies = [
     "opentelemetry-api",
     "opentelemetry-sdk",
     "opentelemetry-instrumentation",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-tooling-extensions-agentframework/pyproject.toml

@@ -29,6 +29,11 @@ dependencies = [
     "azure-identity",
     "typing-extensions",
     "httpx",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
+    "pyasn1",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-tooling-extensions-googleadk/pyproject.toml

@@ -26,6 +26,11 @@ dependencies = [
     "microsoft-agents-a365-tooling",
     "microsoft-agents-hosting-core",
     "google-adk",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
+    "pyasn1",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-tooling-extensions-openai/pyproject.toml

@@ -26,6 +26,10 @@ dependencies = [
     "microsoft-agents-a365-tooling",
     "openai-agents",
     "asyncio-throttle",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-tooling-extensions-semantickernel/pyproject.toml

@@ -26,6 +26,10 @@ dependencies = [
     "microsoft-agents-a365-tooling",
     "semantic-kernel",
     "aiohttp",
+    # Publish security floors for the framework's transitive dependencies.
+    "mcp",
+    "anyio",
+    "python-multipart",
 ]
 
 [project.urls]

libraries/microsoft-agents-a365-tooling/pyproject.toml

@@ -26,6 +26,8 @@ dependencies = [
     "pydantic",
     "typing-extensions",
     "microsoft-agents-hosting-core",
+    # Publish the security floor for the hosting SDK's transitive dependency.
+    "PyJWT",
 ]
 
 [project.urls]

pyproject.toml

@@ -71,6 +71,8 @@ override-dependencies = [
 # Centralized version constraints for all external dependencies
 # Individual package pyproject.toml files declare dependencies by name only (no version)
 # uv applies these constraints during dependency resolution
+# Security-critical transitive dependencies must also be declared by affected libraries
+# so the build backend includes their minimum versions in published wheel metadata.
 constraint-dependencies = [
     # --- Observability (OpenTelemetry) ---
     "opentelemetry-api >= 1.36.0",
@@ -89,7 +91,9 @@ constraint-dependencies = [
     # --- AI Frameworks ---
     "agent-framework >= 1.0.0",
     "agent-framework-core >= 1.0.0",
-    "langchain-core >= 0.1.0",
+    "langchain-core >= 1.3.3",
+    "langsmith >= 0.8.18",
+    "mcp >= 1.28.1",
     "openai-agents >= 0.2.6",
     "semantic-kernel >= 1.39.3",
     # google-adk >=1.28.1,<2.0.0 - security remediation. Fixes CVE-2026-4810
@@ -111,10 +115,13 @@ constraint-dependencies = [
 
     # --- Data Validation & Utilities ---
     "aiohttp >= 3.8.0",
+    "anyio >= 4.14.2",
     "asyncio-throttle >= 1.0.0",
     "httpx >= 0.27.0",
+    "pyasn1 >= 0.6.4",
     "pydantic >= 2.0.0",
-    "PyJWT >= 2.8.0",
+    "PyJWT >= 2.14.0",
+    "python-multipart >= 0.0.30",
     "typing-extensions >= 4.0.0",
 
     # --- Tox ---